FIDO2 passwordless IAM platforms

Several major identity and access management (IAM) platforms support passwordless authentication using FIDO2 security keys over the WebAuthn standard. Users authenticate with a physical key, such as a YubiKey, typically by inserting or tapping it and verifying with a PIN or biometric instead of entering an account password.

Leading IAM solutions with FIDO2 passwordless support

IAM solution	FIDO2 passwordless support	Best fit
Microsoft Entra ID	Yes — passwordless sign-in to Microsoft 365, cloud apps, and supported Windows devices	Microsoft-centric enterprises
Okta	Yes — FIDO2 keys for supported authentication flows and Windows desktop sign-in	SaaS-heavy and hybrid environments
Cisco Duo	Yes — Duo Passwordless supports WebAuthn FIDO2 security keys	Organizations adding passwordless to existing SSO
Ping Identity	Available through supported PingID and PingFederate authentication configurations; verify the specific deployment	Enterprise federation and complex identity architectures
IBM Security Verify	FIDO2/WebAuthn capabilities are available in supported configurations; verify the exact product and deployment	Hybrid and enterprise identity
Keycloak	Yes — WebAuthn authenticators can be configured as passwordless credentials	Open-source and self-hosted IAM

Microsoft documents FIDO2 security-key sign-in for Entra ID and supported Windows devices. Cisco Duo explicitly supports FIDO2 WebAuthn keys for passwordless web application access.learn.microsoft.com+2

Official documentation and verification

Microsoft Entra ID

Supports FIDO2 keys for passwordless cloud sign-in and Windows sign-in on supported joined devices.

Documentation:Configure FIDO2 security keys

Okta

Supports FIDO2/WebAuthn security keys. Its desktop passwordless options have separate OS and configuration requirements.

Documentation:Passwordless sign-in configuration

Cisco Duo

Supports passwordless web authentication using FIDO2 keys, with SAML/OIDC application integration.

Documentation:Duo Passwordless

Ping Identity

PingID and PingFederate can provide FIDO2 passwordless authentication when configured with the required integration versions and discoverable credentials.

Documentation:Configure FIDO2 passwordless authentication

IBM Security Verify

Supports FIDO2 as a first-factor password replacement for its web interfaces and integrated SSO applications.

Documentation:FIDO2 authentication

![KeyCloak

    – CNCF Store | Get stickers, t-shirts, hoodies, and more.](https://images.openai.com/static-rsc-4/qo71dGfRd8hnYcZw2ZsST53sWnlOcb6EbRd6CGIXbHgyIGO8Ml-WIIS7MSdSOtWTi69V7BEm14phQeZlV5IZuphgXu-TGq9uNKrvPKV9vMu7BInQF8K623MRQ59MOum_gxvTjCi0U4HHN7abLJWLW1BvzaehlpdjhD9YfEQzz3Nck4azPCi-QsaK5sRsHUjq?purpose=fullsize)

Keycloak

Offers configurable passwordless WebAuthn authentication, making it a strong option for self-hosted identity infrastructure.

Documentation:Keycloak Server Administration Guide

The product-specific capabilities above are documented by the vendors.learn.microsoft.com+5

How to choose

• Microsoft 365 and Windows: Start with Microsoft Entra ID.
• Cloud applications and enterprise SSO: Compare Okta and Ping Identity.
• Add passwordless authentication to an existing environment: Consider Cisco Duo.
• Self-hosted or open-source IAM: Consider Keycloak.
• Enterprise hybrid environments: Evaluate IBM Security Verify alongside the other options.

Important distinction: FIDO2 support does not automatically mean every login is passwordless. Some products use a security key only as a second factor, or require different licensing, policies, or integration versions for password-free sign-in. For true passwordless access, verify that the specific login flow supports FIDO2 discoverable credentials and PIN/biometric user verification.

Migrating to a passwordless, phishing-resistant standard involves choosing solutions across three main pillars: Identity Providers (IdPs) to manage policies and user directories, Hardware Authenticators for physical security keys, and Platform Authenticators/Software for biometrics and device-bound passkeys.decryptiondigest.com+2

The leading FIDO2-compliant solutions and vendors mapped to these categories include:

1. Identity Providers & Access Management (IdPs)

These platforms handle the core authentication policies, integrate with your directory services, and process WebAuthn/FIDO2 challenges for your corporate applications.

• Microsoft Entra ID: Offers comprehensive, native support for FIDO2 security keys and passkeys across Windows, Azure, and integrated enterprise apps, complete with hardware vendor attestation tracking.learn.microsoft.com+1
• Cisco Duo: Provides robust enterprise multi-factor and passwordless authentication, supporting FIDO2 hardware keys and platform authenticators seamlessly with wide policy enforcement capabilities.startwithidentity.com+1
• Okta: Delivers modern workforce and customer authentication through Okta FastPass and WebAuthn standards, allowing passwordless login using biometrics or security keys.yubico.com+2
• Ping Identity: Integrates deeply with FIDO2 and WebAuthn protocols via PingID, enabling enterprises to blend hardware keys and device biometrics into adaptive access policies.pingidentity.com+1

2. Hardware Security Key Vendors

For high-assurance environments, shared workstations, or privileged access management where software-only passkeys aren't enough, physical keys are the gold standard.startwithidentity.com

• Yubico (YubiKey): The most widely recognized hardware-backed FIDO2/U2F security key provider, offering USB-A, USB-C, NFC, and Lightning capabilities.
• HID Global: Offers enterprise-grade FIDO2 smart cards and security tokens tailored for physical and logical access unification.
• Kensington: Manufactures biometric and standard FIDO2 USB security keys designed for enterprise laptop and desktop use.infisign.ai+1

3. Ecosystem & Platform Authenticators

If you plan to leverage built-in hardware chips (like TPM or Secure Enclave) and operating system biometrics (Windows Hello, Touch ID, Face ID, Android Biometrics):

• Apple: Fully FIDO2/WebAuthn compliant via Touch ID and Face ID, syncing passkeys securely across devices via iCloud Keychain.
• Google: Supports FIDO2 platform authenticators on Android devices and ChromeOS, allowing phones to act as secure roaming or platform authenticators.
• Microsoft Windows Hello: Provides native FIDO2 platform authenticator capabilities built directly into Windows 10 and 11 environments.infisign.ai

To get a granular, official list of certified hardware and software modules, you can search the official FIDO Certified Products Directory maintained by the FIDO Alliance.fidoalliance.org

If you'd like to narrow this down, tell me:

• What Identity Provider or directory are you currently using?
• Do you need hardware keys (USB/NFC) , or are you aiming for software/biometric passkeys on existing user devices?

Yes. For a passwordless migration, there are several established FIDO2/WebAuthn options. The main distinction is whether you need an identity provider, a passwordless authentication platform, or hardware authenticators.

Major FIDO2/passwordless providers

Provider	Solution	Typical fit
Microsoft	Microsoft Entra ID + passkeys/FIDO2 security keys	Organizations already using Microsoft 365/Entra
Okta	Okta Workforce Identity / Customer Identity with passkeys	Enterprise workforce or customer IAM
Cisco Duo	Duo Passwordless	Passwordless access layered onto existing SSO/IdP
Ping Identity	PingOne / PingFederate with FIDO2/WebAuthn	Enterprise IAM and complex federation
Yubico	YubiKey / YubiKey Bio	Hardware FIDO2 authenticators
Thales	FIDO2 security keys and smart-card solutions	Enterprise/government environments
HYPR	HYPR Workforce Access	Dedicated passwordless workforce authentication
1Password	Passkeys	Password-manager-based passkey deployment
Auth0	Passkeys/WebAuthn	Developer-oriented customer authentication
LoginID	FIDO2/passwordless authentication	Dedicated FIDO authentication infrastructure

FIDO's own certification directory is the best starting point if formal FIDO certification is a procurement requirement: it currently lists 1,200+ certified implementations and lets you filter by product type and certification.FIDO Alliance+1

A few important distinctions

Microsoft Entra ID supports both synced and device-bound FIDO2 passkeys, as well as FIDO2 security keys. Microsoft maintains a compatibility matrix covering browsers, operating systems and third-party IdPs.Microsoft Learn+1

Cisco Duo Passwordless supports platform passkeys such as Windows Hello, Touch ID and Android biometrics, as well as FIDO2/WebAuthn security keys from vendors such as Yubico and Feitian.Cisco Duo

Yubico is primarily an authenticator vendor rather than an IdP: its YubiKeys provide FIDO2/WebAuthn credentials that can work with systems such as Entra, Duo and other compatible IdPs.Cisco Duo

One procurement nuance: “supports FIDO2” isn't necessarily the same as “FIDO Certified.” The FIDO Alliance certification program separately certifies authenticators, clients and servers for conformance and interoperability.FIDO Alliance+1

If you tell me whether this is for employees/workforce IAM, customer authentication (CIAM), or both, plus your existing stack (e.g. Entra, Okta, Google Workspace, AD), I can narrow this to the relevant vendors and compare their architecture, deployment model, and migration considerations.

If you mean customer authentication for a modern SaaS/web app, I’d shortlist Clerk, Stytch, WorkOS AuthKit, and Auth0. They all support passkeys, but they optimize for somewhat different things.WorkOS+1

My take

For a new SaaS: I'd start with Clerk if you're using React/Next.js. Its strength is getting a polished authentication experience—including passkeys, MFA, social login, organizations, and account management—without building much UI yourself. Current industry comparisons also consistently put Clerk in the developer-first category.StackFYI+1

For a genuinely passkey-first product: I'd seriously consider Stytch. Its architecture and product surface are particularly oriented toward passwordless authentication and passkeys rather than treating them as an add-on.Propicked

For B2B SaaS selling to enterprises: WorkOS AuthKit is compelling. It combines passkeys with MFA and the enterprise machinery around SSO/SAML, organizations, and directory integrations. One interesting detail: WorkOS treats a passkey with user verification as satisfying both authentication factors when MFA is required.WorkOS+1

For a large/complex CIAM deployment: Auth0 remains a strong option. It supports WebAuthn/passkeys plus a particularly broad MFA surface, including hardware security keys and adaptive MFA.Auth0

What I'd want from a "modern MFA" stack

Don't optimize merely for "supports MFA." I'd look for:

• Passkeys/WebAuthn as the preferred authentication method
• TOTP as a fallback
• Recovery codes
• Hardware security keys/FIDO2
• Avoid making SMS the primary MFA mechanism
• Device/session management and remote session revocation
• Strong account-recovery controls
• Rate limiting / bot protection
• Good support for OAuth/OIDC
• Enterprise SAML + SCIM if you're B2B
• APIs for managing credentials rather than locking everything into hosted UI

One particularly important architectural point: passkeys can themselves provide phishing-resistant multi-factor authentication when user verification is required; you don't necessarily want to force users through "passkey + TOTP" on every login. WorkOS explicitly implements this behavior.WorkOS

If you tell me your stack (e.g. Next.js, Rails, Django, mobile), B2C vs B2B, and approximate MAU, I can narrow this to 1–2 choices and compare pricing + implementation complexity.